Corrective releases of the distributed version control system Git 2.38.1, 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 have been published, addressing two vulnerabilities that occur when using the ‘git clone’ command in ‘—recurse-submodules’ mode with unverified repositories and during the interactive mode of ‘git shell’. You can track the release of package updates in distributions on the pages of Debian, Ubuntu, RHEL, SUSE/openSUSE, Fedora, Arch, and FreeBSD.
- CVE-2022-39253 — This vulnerability allows an attacker controlling the contents of the cloned repository to access sensitive data on the user's system by placing symbolic links to interesting files in the $GIT_DIR/objects directory of the cloned repository. The issue occurs only during local cloning (in ‘—local’ mode, which is used when the source and target data for cloning are on the same partition) or when cloning a malicious repository packed as a submodule within another repository (for example, when recursively including submodules with the ‘git clone —recurse-submodules’ command).
The vulnerability arises because, in ‘—local’ cloning mode, git transfers the contents of $GIT_DIR/objects to the target directory (creating hard links or copies of files) while dereferencing symbolic links (i.e., the target directory ends up with the actual files pointed to by the links rather than the symbolic links themselves). To mitigate this vulnerability in the new Git releases, cloning repositories in ‘—local’ mode containing symbolic links in the $GIT_DIR/objects directory has been prohibited. Additionally, the default value of the protocol.file.allow parameter has been changed to ‘user’, categorizing cloning operations using the file:// protocol as unsafe.
- CVE-2022-39260 — An integer overflow in the split_cmdline() function used in the ‘git shell’ command. This issue can be exploited by users who use ‘git shell’ as their login shell and have the interactive mode enabled (a $HOME/git-shell-commands file is created). Exploiting this vulnerability may lead to arbitrary code execution on the system when a specially crafted command larger than 2 GB is passed.
Source: opennet.ru
